Re: escape string for pgsql (using jdbc/java)?

On Sun, 28 Jan 2007, Tobias Thierer wrote:

> Kris Jurka wrote:
>
>>>  1.) Is there a built-in method somewhere in the jdbc driver that escapes
>>>      strings and makes them safe to use in an SQL statement (inside a
>>>      string)?
>> 
>> There is org.postgresql.core.Utils#appendEscapedString, but it's not 
>> something we support or advertise.  It's really for internal use only.
>
> I dislike that this method expects me to tell it whether i have 
> standard_conforming_strings set - this kinda defeats the "write once, run 
> everywhere" principle.
>
> If I replace \ with \\ and DO have standard_conforming_strings set, then this 
> will actually create two \ characters in my string - right? So there is no 
> way I can do this "safely".

Right, again this is really something just for the driver (which does know 
the setting of standard_conforming_strings.

>>>  2.) Which characters do I need to escape for pgsql? Is ' the only one,
>>>      and I need to escape it as '' ? Do I need to escape \ ? Will I need 
>>> to
>>>      escape all the characters that I escaped for MySQL? Where can I find
>>>      out more?
>> 
>> You need to escape ' and \ if you standard_conforming_strings is on. 
>> Monitoring this setting can be tough, so the safest thing to do is probably 
>> to always use the E'string' escape syntax and escape both characters.
>
> I haven't found anything in the documentation about how this syntax works 
> exactly. The documentation refers to "the E'...' syntax", but doesn't tell me 
> what this syntax actually is (am I supposed to already know how this syntax 
> works, so just need to be told to use it!?). Do I have to put the E in front 
> of the beginning ', i.e.
>
>   'foo'
>
> becomes E'foo' ? (that can't be right, there must be some way I escape ' 
> inside the string). So does 'foo' become
>
>  'E'f'E'o'E'o'' ?
>
> or what? How do I represent the literal string
>
>  foo'bar\baz

I think the documentation I pointed you to earlier describers this 
(4.1.2.1 here 
http://www.postgresql.org/docs/current/static/sql-syntax-lexical.html).

You write WHERE x = E'foo' or x = E'foo''bar\\baz'.  The preceding E 
simply states that you want backslash to mean something special regardless 
of the setting of standard conforming strings.

Kris Jurka